Plex Media Server
8 CVEs affecting Plex Media Server. Latest disclosed: 2026-09-23. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69414 | High | 8.5 | 2026-01-02 | Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token. |
CVE-2025-34158 | High | 8.5 | 2025-08-21 | Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the… |
CVE-2026-96656 | High | 7.2 | 2026-09-23 | Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appen… |
CVE-2025-69415 | High | 7.1 | 2026-01-02 | In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is curre… |
CVE-2026-96654 | Medium | 6.5 | 2026-09-23 | Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions a… |
CVE-2026-96651 | Medium | 6.5 | 2026-09-23 | Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/age… |
CVE-2026-96655 | Medium | 4.3 | 2026-09-23 | Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' p… |
CVE-2026-96652 | Medium | 4.3 | 2026-09-23 | Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' par… |